A TCPA compliance checklist for sales calls has 12 checks, drawn from 47 CFR 64.1200 and the FCC’s caller ID rule (read on 4 November 2026). The core: prior express written consent before an AI or autodialed sales call to a cell phone, telephone solicitations to residential subscribers only from 8 a.m. to 9 p.m. local time, a Do Not Call Registry version no more than 31 days old for the safe harbor, and opt-outs honored within 10 business days at most. Under 47 U.S.C. 227, a robocall violation can cost $500 or the actual monetary loss, if greater, and up to three times that if willful or knowing.
In my view, a TCPA checklist without dates is a liability, and the bigger mistake is treating compliance as a consent form. The consent rules moved twice in 2025, and the revocation rule moves again on 25 November 2026.
Consent is two of the twelve checks. An AI sales message must offer an opt-out within two seconds of naming the business, and a do-not-call request is honored for five years.
Key numbers
| Item | Number |
|---|---|
| Federal window for telephone solicitations (to residential subscribers, local time at the called party’s location) | 8 a.m. to 9 p.m. |
| Oldest Do Not Call Registry version for the safe harbor (before the call, with records of the process) | 31 days |
| Established business relationship window (after a purchase; 3 months after an inquiry) | 18 months |
| Deadline to honor a revocation or do-not-call request (at most; within a reasonable time from receipt) | 10 business days |
| How long a do-not-call request must be honored (from the time it is made) | 5 years |
| Opt-out offer in an AI or prerecorded sales message (of identifying the business) | Within 2 seconds |
| Minimum ring time before hanging up (telemarketing calls) | 15 seconds or 4 rings |
| Abandoned-call ceiling (of telemarketing calls answered live by a person, per campaign, per 30 days) | 3% |
| Damages per robocall violation (47 U.S.C. 227(b)(3)) (or actual monetary loss if greater; a court may treble it if willful or knowing) | $500 |
| FCC 24-17 released (AI voices covered) | 8 February 2024 |
| One-to-one consent rule vacated (Eleventh Circuit) (Insurance Marketing Coalition v. FCC) | 24 January 2025 |
| Exclusive means to revoke consent allowed (FCC 26-67) (existing opt-out methods for exempt and telemarketing calls unchanged) | 25 November 2026 |
Read on 4 November 2026 from 47 CFR 64.1200 and 64.1601 on eCFR, 47 U.S.C. 227 on LII, the Eleventh Circuit opinion in No. 24-10277, FCC 24-17 and DA 24-1068 on docs.fcc.gov, and FCC 26-67 in the Federal Register.
The 12-point TCPA compliance checklist
| # | Check | Rule (47 CFR 64.1200 unless noted) |
|---|---|---|
| 1 | Prior express written consent before an AI, prerecorded or autodialed sales call to a cell phone, or an AI or prerecorded one to a home line | (a)(2), (a)(3) |
| 2 | That consent is a signed written agreement naming the number, with both disclosures below | (f)(9) |
| 3 | Telephone solicitations to residential subscribers only from 8 a.m. to 9 p.m., local time at the called party’s location; (e) extends this to wireless numbers as the FCC’s 2003 order describes | (c)(1), (e) |
| 4 | No telephone solicitations to numbers on the National Do Not Call Registry; the safe harbor needs a registry version no more than 31 days old (see what registry access costs) | (c)(2) |
| 5 | A written do-not-call policy, available on demand, and trained staff | (d)(1), (d)(2) |
| 6 | Do-not-call requests recorded when made, honored within 10 business days at most, and honored for 5 years | (d)(3), (d)(6) |
| 7 | Each sales call gives the caller’s name, the name of the business it is made for and a phone number or address | (d)(4) |
| 8 | AI and prerecorded messages state the business’s registered name first, then a callback number | (b)(1), (b)(2) |
| 9 | AI and prerecorded messages that advertise, telemarket or rely on an (a)(3) exemption offer an automated voice or key-press opt-out, with brief instructions, within 2 seconds of that identification | (b)(3) |
| 10 | Revocations by any reasonable method honored within 10 business days at most (TCPA opt-out requirements) | (a)(10), (a)(11) |
| 11 | Caller ID sent (CPN or ANI, plus your name when your carrier makes it available), never blocked | 64.1601(e) |
| 12 | Ring at least 15 seconds or four rings; abandon no more than 3% of telemarketing calls answered live by a person, per campaign, per 30 days, with records (the 3% abandonment rule) | (a)(6), (a)(7) |
Checks 3 and 4 cover “telephone solicitations”, which (f)(15) defines to exclude calls to a person with their “prior express invitation or permission” or within an established business relationship (a purchase in the last 18 months or an inquiry in the last three, not since ended). For a registered number, (c)(2)(ii) wants that permission “evidenced by a signed, written agreement” naming the seller and the number.
The (c)(2) safe harbor requires “records documenting this process”, and (m) puts “the burden of proof and persuasion” on you for reassigned numbers (see the reassigned numbers database). Do-not-call damages under (c)(5) are up to $500 per call once a person gets more than one from the same entity in 12 months, with a “due care” defense. Texts count where a rule names them, as (a)(10) does (see how the rules treat texts).
What a valid consent form must say
Under (f)(9), prior express written consent is “an agreement, in writing, bearing the signature of the person called that clearly authorizes the seller” to send ads or telemarketing by autodialer or artificial or prerecorded voice, to a number it names. It needs a clear and conspicuous disclosure of two things: that signing authorizes those calls, and that the person is “not required to sign the agreement” as a condition of buying anything.
What it does not need: in Insurance Marketing Coalition v. FCC, decided on 24 January 2025, the Eleventh Circuit vacated Part III.D of the FCC’s 2023 Order, under which consent had to be “to calls from only one entity at a time” and limited to calls “logically and topically associated with the interaction that prompted the consent,” and remanded.
Three dates behind the checklist
- 8 February 2024. FCC 24-17, released that day, confirmed that the TCPA’s artificial or prerecorded voice rules “encompass current AI technologies that generate human voices.”
- 11 April 2025. FCC public notice DA 24-1068 made this the compliance date for the revocation rules in (a)(9)(i)(F), (a)(10), (a)(11) and (d)(3): any reasonable method revokes consent.
- 25 November 2026. Under FCC 26-67, callers may designate an exclusive means to revoke consent, disclosed on the call or in the text, but the FCC says this “does not alter the existing opt-out methods specified in our rules for calls made pursuant to an exemption or that include an advertisement or constitute telemarketing.”
Two checks an AI voice agent can miss
Timing. Under (a)(7), a telemarketing call is abandoned if it is “not connected to a live sales representative within two (2) seconds of the called person's completed greeting”, unless it plays an artificial or prerecorded message, within two seconds, to someone who gave prior express written consent. I would fix the opening and opt-out in code and retest after every model or voice change, on any of the AI voice agent platforms.
The list. Under (d)(3), if another party keeps your do-not-call list, “the person or entity on whose behalf the call is made will be liable for any failures to honor the do-not-call request” (see vendor liability). Keep one list that the dialer and the SMS tool both read.
“The consent form is solid, so we are compliant.”
Consent is two checks. Hours, the registry, identification, the two-second opt-out and the do-not-call list make up most of the rest.
Twelve checks, each with a paragraph number and an owner.
Retested after every script, model or vendor change, against the eCFR text.
Four things to do this week
Give every check an owner
Copy the table into your runbook with the paragraph number, an owner and the date you last checked it against eCFR. For state rules, see telemarketing laws by state.
Call your own agent
Time the opening: the business name first, then the opt-out within two seconds. Say “stop calling me”, then confirm the number reached the do-not-call list your dialer and SMS tool both read.
Audit your consent form
Check both disclosures and the number field. My view: name the seller exactly as your calls will, and store the form text, signature record, timestamp and number with each lead. Electronic signatures count where federal law or state contract law recognizes them.
Plan for 25 November
For informational calls and texts that rely on consent, decide whether to designate an exclusive way to revoke it, and disclose it on the call or in the text. For sales calls and exempt AI or prerecorded calls, the existing opt-out methods, including the two-second opt-out, stay.
My team’s record: 500+ projects delivered across 30 countries. In the AI calling built around TCPA consent we set up, the registry and your opt-out list are checked before the dialer and consent is logged; your consent wording and process remain yours. Home services: see AI calling for home services and our AI answering service for HVAC breakdown.
The bottom line
Check all twelve against eCFR before you rely on them. Calling outside the US? See cold calling laws by country or South Africa’s rules. I am not a lawyer. This is general information, not legal advice.